
- Malicious NPM package lotusbail hijacks WhatsApp accounts, stealing tokens, messages, and contacts
- Attackers link their device via WhatsApp pairing, persisting even after package removal
- Package had 56,000+ downloads before discovery; developers urged to verify sources carefully
Node Package Manager (NPM) registry users are being targeted with malware that takes over their WhatsApp accounts, steals messages, and contacts lists, experts have warned.